DEBIAN-CVE-2026-126869: Use After Free
Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Debian's chromium package running a version prior to 157.0.8103.78 are exposed when they load attacker-crafted HTML content.
What does an attacker need to exploit it?
The attacker needs to cause the target to process a crafted HTML page remotely. Successful exploitation can execute arbitrary code inside the browser sandbox.
Is this a sandbox escape?
No. The available information states that code execution occurs inside the sandbox; it does not say that the attacker can escape the sandbox or compromise the underlying system.
How can I determine whether a system is affected?
Check the installed Debian chromium version. Versions earlier than 157.0.8103.78 are affected according to the vulnerability information.